CVE-2013-0256

19

FAUCET Score

CVE-2013-0256 describes a cross-site scripting (XSS) vulnerability in the darkfish.js component of RDoc versions 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby. This flaw allows remote attackers to inject malicious scripts via a crafted URL due to improper document generation. The vulnerability has a CVSS score of 4.3, indicating a medium attack complexity and potential for partial integrity impact, with no confidentiality or availability impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 2.3.0, < 3.12CPE matchmatch criteria	cpe:2.3:a:ruby-lang:rdoc::::::ruby::*
		4.0.0CPE matchmatch criteria	cpe:2.3:a:ruby-lang:rdoc:4.0.0:preview2::::ruby::*
		1.9CPE matchmatch criteria	cpe:2.3:a:ruby-lang:ruby:1.9:::::::*
		1.9.1CPE matchmatch criteria	cpe:2.3:a:ruby-lang:ruby:1.9.1:::::::*
		1.9.2CPE matchmatch criteria	cpe:2.3:a:ruby-lang:ruby:1.9.2:::::::*

CVSS Data

CVSS version used by this source: 2.0

4.3MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:N

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Exploitability Score

8.6

Impact Score

2.9

CvssVersion

2.0

Exploit Intelligence

EPSS Score

3.00%

Probability of exploitation in next 30 days

EPSS Percentile

86.0%

Percentile rank of EPSS score among Peer Group

As of 2026-07-24

Model: v2026.06.15

This CVE's current EPSS score of 0.0300 is in the 79th percentile among its peer group of 19,953 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (42)

redhatpatch availablevia redhat_api

Product: RHEL 6 Version of OpenShift EnterpriseFixed in: ruby193-rubygem-fastthread-0:1.0.7-7.el6op

redhatpatch availablevia redhat_api

Product: CloudForms for RHEL 6Fixed in: rubygem-activesupport-1:3.0.10-10.el6cf

redhatpatch availablevia redhat_api

Product: CloudForms for RHEL 6Fixed in: rubygem-delayed_job-0:2.1.4-3.el6cf

redhatpatch availablevia redhat_api

Product: CloudForms for RHEL 6Fixed in: rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf

redhatpatch availablevia redhat_api

Product: CloudForms for RHEL 6Fixed in: rubygem-rack-1:1.3.0-3.el6cf

redhatpatch availablevia redhat_api

Product: CloudForms for RHEL 6Fixed in: rubygem-rails_warden-0:0.5.5-2.el6cf

redhatpatch availablevia redhat_api

Product: CloudForms for RHEL 6Fixed in: rubygem-rdoc-0:3.8-6.el6cf

redhatpatch availablevia redhat_api

Product: CloudForms for RHEL 6Fixed in: rubygem-rspec-rails-0:2.6.1-7.el6cf

redhatpatch availablevia redhat_api

Product: CloudForms for RHEL 6Fixed in: rubygem-ruby_parser-0:2.0.4-6.el6cf

redhatpatch availablevia redhat_api

Product: CloudForms for RHEL 6Fixed in: rubygem-shoulda-0:2.11.3-5.el6cf

redhatpatch availablevia redhat_api

Product: Red Hat Subscription Asset Manager 1.2Fixed in: candlepin-0:0.7.24-1.el6_3

redhatpatch availablevia redhat_api

Product: Red Hat Subscription Asset Manager 1.2Fixed in: katello-0:1.2.1.1-1h.el6_4

redhatpatch availablevia redhat_api

Product: Red Hat Subscription Asset Manager 1.2Fixed in: katello-configure-0:1.2.3.1-4h.el6_4

redhatpatch availablevia redhat_api

Product: Red Hat Subscription Asset Manager 1.2Fixed in: rubygem-actionpack-1:3.0.10-12.el6cf

redhatpatch availablevia redhat_api

Product: Red Hat Subscription Asset Manager 1.2Fixed in: rubygem-activemodel-0:3.0.10-3.el6cf

redhatpatch availablevia redhat_api

Product: Red Hat Subscription Asset Manager 1.2Fixed in: rubygem-delayed_job-0:2.1.4-3.el6cf

redhatpatch availablevia redhat_api

Product: Red Hat Subscription Asset Manager 1.2Fixed in: rubygem-json-0:1.7.3-2.el6_3

redhatpatch availablevia redhat_api

Product: Red Hat Subscription Asset Manager 1.2Fixed in: rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf

redhatpatch availablevia redhat_api

Product: Red Hat Subscription Asset Manager 1.2Fixed in: rubygem-rack-1:1.3.0-4.el6cf

redhatpatch availablevia redhat_api

Product: Red Hat Subscription Asset Manager 1.2Fixed in: rubygem-rails_warden-0:0.5.5-2.el6cf

redhatpatch availablevia redhat_api

Product: Red Hat Subscription Asset Manager 1.2Fixed in: rubygem-rdoc-0:3.8-6.el6cf

redhatpatch availablevia redhat_api

Product: Red Hat Subscription Asset Manager 1.2Fixed in: thumbslug-0:0.0.28.1-1.el6_4

redhatpatch availablevia redhat_api

Product: RHEL 6 Version of OpenShift EnterpriseFixed in: ruby193-ruby-0:1.9.3.327-28.el6

redhatpatch availablevia redhat_api

Product: RHEL 6 Version of OpenShift EnterpriseFixed in: rubygem-json-0:1.7.3-2.el6op

redhatpatch availablevia redhat_api

Product: RHEL 6 Version of OpenShift EnterpriseFixed in: rubygem-rdoc-0:3.8-9.el6op

redhatpatch availablevia redhat_api

Product: RHEL 6 Version of OpenShift EnterpriseFixed in: ruby193-rubygem-activesupport-1:3.2.8-4.el6

redhatpatch availablevia redhat_api

Product: RHEL 6 Version of OpenShift EnterpriseFixed in: ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6

redhatpatch availablevia redhat_api

Product: RHEL 6 Version of OpenShift EnterpriseFixed in: ruby193-rubygem-bson-0:1.5.2-6.el6op

redhatpatch availablevia redhat_api

Product: RHEL 6 Version of OpenShift EnterpriseFixed in: ruby193-rubygem-chunky_png-0:1.2.6-3.el6op

redhatpatch availablevia redhat_api

Product: RHEL 6 Version of OpenShift EnterpriseFixed in: ruby193-rubygem-ci_reporter-0:1.7.2-4.el6op

redhatpatch availablevia redhat_api

Product: RHEL 6 Version of OpenShift EnterpriseFixed in: ruby193-rubygem-compass-0:0.12.2-4.el6op

redhatpatch availablevia redhat_api

Product: RHEL 6 Version of OpenShift EnterpriseFixed in: ruby193-rubygem-rack-test-0:0.6.1-3.el6

redhatpatch availablevia redhat_api

Product: RHEL 6 Version of OpenShift EnterpriseFixed in: ruby193-rubygem-rspec-0:2.11.0-2.el6

redhatpatch availablevia redhat_api

Product: RHEL 6 Version of OpenShift EnterpriseFixed in: ruby193-rubygem-treetop-0:1.4.10-6.el6

redhatpatch availablevia redhat_api

Product: RHEL 6 Version of OpenShift EnterpriseFixed in: ruby193-rubygem-xml-simple-0:1.0.12-10.el6op

redhatpatch availablevia redhat_api

Product: RHEL 6 Version of OpenShift EnterpriseFixed in: ruby193-rubygem-haml-0:3.1.7-3.el6op

redhatpatch availablevia redhat_api

Product: RHEL 6 Version of OpenShift EnterpriseFixed in: ruby193-rubygem-http_connection-0:1.4.1-7.el6

redhatpatch availablevia redhat_api

Product: RHEL 6 Version of OpenShift EnterpriseFixed in: ruby193-rubygem-rack-1:1.4.1-5.el6

rubygemspatch availablevia ghsa

Product: rdocFixed in: 3.12.1

redhatno patchvia redhat_api

Product: Red Hat Subscription Asset ManagerFixed in: rubygem-haml

redhatno patchvia redhat_api

Product: OpenShift Enterprise 1Fixed in: rubygem-haml

redhatno patchvia redhat_api

Product: Red Hat Enterprise MRG 2Fixed in: rubygem-haml

Vendor Advisories (2)

rubygemsGHSA-v2r9-c84j-v7xmmedium

RDoc contains XSS vulnerability

redhatCVE-2013-0256Moderate

rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template

References

blog.segment7.net / 2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2

Third Party Advisory

lists.opensuse.org / opensuse-security-announce/2013-04/msg00015.html

Mailing ListThird Party Advisory

lists.opensuse.org / opensuse-updates/2013-02/msg00048.html

Mailing ListThird Party Advisory

rhn.redhat.com / errata/RHSA-2013-0548.html

Third Party Advisory

rhn.redhat.com / errata/RHSA-2013-0686.html

Third Party Advisory

rhn.redhat.com / errata/RHSA-2013-0701.html

Third Party Advisory

rhn.redhat.com / errata/RHSA-2013-0728.html

Third Party Advisory

bugzilla.redhat.com / show_bug.cgi

Issue Tracking

secunia.com / advisories/52774

Third Party Advisory

github.com / rdoc/rdoc/commit/ffa87887ee0517793df7541629a470e331f9fe60

Third Party Advisory

ruby-lang.org / en/news/2013/02/06/rdoc-xss-cve-2013-0256

Vendor Advisory

ubuntu.com / usn/USN-1733-1

Third Party Advisory